Cisco IOS XR User Manual

Implementing Internet Key Exchange Security Protocol on Cisco IOS XR Software
Configuration Examples for Implementing IKE Security Protocol
SC-68
Cisco IOS XR System Security Configuration Guide
Configuration Examples for Implementing IKE Security Protocol
This section provides the following configuration examples:
• Creating IKE Policies: Example, page SC-69
• Configuring a service-ipsec Interface with a Dynamic Profile: Example, page SC-69
• Configuring Easy VPN with a Local AAA: Example, page SC-70
• Configuring VRF-Aware: Example, page SC-71
Step 8
set interface {service-ipsec | service-gre}
intf-index
Example:
RP/0/RP0/CPU0:router(config-isa-prof-match)# set
interface service-ipsec 50
or
RP/0/RP0/CPU0:router(config-isa-prof-match)# set
interface service-gre 1000
Predefines the virtual interface when IKE negotiates
for IPSec SAs and the local endpoint is the IKE
responder.
• Use the service-ipsec keyword to specify the
IPSec service interfaces.
• Use the service-gre keyword to specify the
GRE service interfaces.
• Use the intf-index argument to set the range
from 1 to 65535.
Step 9
end
or
commit
Example:
RP/0/RP0/CPU0:router(config-isa-prof-match)# end
or
RP/0/RP0/CPU0:router(config-isa-prof-match)# commit
Saves configuration changes.
• When you issue the end command, the system
prompts you to commit changes:
Uncommitted changes found, commit them
before exiting(yes/no/cancel)?
[cancel]:
– Entering yes saves configuration changes to
the running configuration file, exits the
configuration session, and returns the
router to EXEC mode.
– Entering no exits the configuration session
and returns the router to EXEC mode
without committing the configuration
changes.
– Entering cancel leaves the router in the
current configuration session without
exiting or committing the configuration
changes.
• Use the commit command to save the
configuration changes to the running
configuration file and remain within the
configuration session.
Command or Action Purpose

Cisco IOS XR Specifications

General

Operating System	Cisco IOS XR
Architecture	Microkernel
High Availability	Yes
Type	Network operating system
Developed by	Cisco Systems
License	Proprietary
Programming Language	C, C++
Kernel	QNX
Supported Platforms	Cisco ASR9000, NCS series
Security Features	Role-Based Access Control (RBAC), Secure Boot, Encryption
Management Interface	CLI, SNMP, NETCONF, RESTCONF
Release Date	2004
Target Devices	High-end core routers, service provider edge routers, data center interconnect (DCI) routers
Supported Hardware	Cisco routers and switches
Networking Protocols	BGP, OSPF, IS-IS, MPLS
Virtualization Support	Virtualization-ready, supports network function virtualization (NFV) and containerization technologies.

Summary

Implementing Certification Authority Interoperability on Cisco IOS XR Software

Prerequisites for Implementing Certification Authority

Lists necessary prerequisites for configuring CA interoperability.

Information About Implementing Certification Authority

Explains CA concepts, standards (IPSec, IKE, PKCS), and authorities.

How to Implement CA Interoperability

Provides step-by-step procedures for CA interoperability configuration.

Implementing Internet Key Exchange Security Protocol on Cisco IOS XR Software

Prerequisites

Lists necessary prerequisites for configuring IKE security protocol.

Information About Implementing IKE Security Protocol Configurations for IPSec Networks

Explains IKE concepts, standards (IKE, IPSec, ISAKMP, Oakley, Skeme), and algorithms.

IKE Policies

Details IKE policy creation, parameter definitions, and peer agreement for negotiation.

Implementing Keychain Management on Cisco IOS XR Software

Restrictions for Implementing Keychain Management

Notes the impact of system clock changes on key validity.

How to Implement Keychain Management

Covers procedures for configuring keychains, key identifiers, and key strings.

Implementing IPSec Network Security on Cisco IOS XR Software

Prerequisites for Implementing IPSec Network Security

Lists necessary prerequisites for configuring IPSec network security.

Information About Implementing IPSec Networks

Explains IPSec concepts like crypto profiles, access lists, and transform sets.

Perfect Forward Secrecy

Ensures IPSec SA keys are not derived from other secrets for enhanced security.

Implementing Secure Shell on Cisco IOS XR Software

Prerequisites to Implementing Secure Shell

Lists required conditions and images for implementing Secure Shell.

Information About Implementing Secure Shell

Explains SSH server, client, SFTP feature, and AAA integration concepts.

How to Implement Secure Shell

Provides step-by-step procedures for configuring SSH server and client.

Implementing Secure Socket Layer on Cisco IOS XR Software

Prerequisites for Implementing Secure Socket Layer

Lists required conditions for SSL implementation, including key generation and CA enrollment.

Information About Implementing Secure Socket Layer

Explains SSL concepts, including the purpose of certification authorities.

How to Implement Secure Socket Layer

Provides procedures for configuring SSL, including key generation and trustpoint setup.

Configuring AAA Services on Cisco IOS XR Software

Prerequisites for Configuring AAA Services

Lists required conditions before configuring AAA services.

Information About Configuring AAA Services

Explains AAA concepts, users, groups, tasks, and administrative models.

How to Configure AAA Services

Procedures for configuring AAA services, including method lists and server communication.

Implementing Management Plane Protection on Cisco IOS XR Software

Restrictions for Implementing Management Plane Protection

Notes that out-of-band configurations for management traffic are not supported.

Information About Implementing Management Plane Protection

Explains management plane protection concepts, interfaces, and control plane.

How to Configure a Device for Management Plane Protection

Provides procedures for configuring MPP to restrict management traffic to specific interfaces.